Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About jacobpevans
jacobpevans
Motivator
Member since:
06-14-2019
03-20-2025
Community Statistics
| Posts | 293 |
| Solutions | 42 |
| Karma Given | 219 |
| Karma Received | 82 |
| Member Since | 2019-06-14 |
Activity Feed
- Got Karma for Re: What does this message mean regarding the health status of Splunkd?. 01-28-2025 05:32 AM
- Got Karma for Re: The percentage of small of buckets is very high and exceeded the red thresholds...-When the red warning will disappear after fixed parsing?. 09-23-2024 02:27 AM
- Got Karma for Re: The percentage of small of buckets is very high and exceeded the red thresholds...-When the red warning will disappear after fixed parsing?. 07-10-2024 01:05 AM
- Got Karma for Re: The percentage of small of buckets is very high and exceeded the red thresholds...-When the red warning will disappear after fixed parsing?. 02-25-2024 05:59 PM
- Got Karma for Re: How to format results and populate a dashboard dropdown filter with mcatalog?. 03-28-2023 03:28 PM
- Got Karma for Splunkd Warning: "C:\program files\...\local.meta already exists but with different casing: C:\Program Files\...\local.meta". 06-17-2022 01:10 PM
- Got Karma for Re: Why is my DB connect checkpoint value not updating?. 06-01-2022 02:18 AM
- Got Karma for Re: Different color for panel title. 03-21-2022 03:25 PM
- Posted Re: What's New in Splunk Cloud Platform 8.2.2201?! on Product News & Announcements. 03-17-2022 06:11 AM
- Got Karma for Re: How do you restart splunk?. 03-07-2022 05:46 AM
- Got Karma for Re: How to delete unwanted special characters in alphanumeric string?. 02-10-2022 05:01 AM
- Got Karma for Re: The percentage of small of buckets is very high and exceeded the red thresholds...-When the red warning will disappear after fixed parsing?. 01-17-2022 09:34 PM
- Got Karma for Re: What does this message mean regarding the health status of Splunkd?. 01-12-2022 01:11 PM
- Got Karma for Re: The percentage of small of buckets is very high and exceeded the red thresholds...-When the red warning will disappear after fixed parsing?. 11-03-2021 01:17 AM
- Karma Re: SimpleXML: Inherent brokenness regarding autorun and Submit button? for woodcock. 09-14-2021 04:26 PM
- Karma Re: How to use a scheduled report as base for dashboard? for niketn. 09-02-2021 05:24 AM
- Got Karma for Re: Different color for panel title. 08-15-2021 03:59 AM
- Got Karma for Re: The percentage of small of buckets is very high and exceeded the red thresholds...-When the red warning will disappear after fixed parsing?. 07-07-2021 11:18 PM
- Posted Re: Windows Event Logs monitoring on All Apps and Add-ons. 05-10-2021 11:13 AM
- Karma Re: How to avoid un-responsive dropdown input with 100K or more results using Simple XML for niketn. 03-18-2021 07:35 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
03-17-2022
06:11 AM
@Anonymous The first two links are dead. I'm really looking forward to this update. Great work! The next big one on my company's list is having dynamic drill-down URLs that link to Splunk dashboards with those dynamic values.
... View more
05-10-2021
11:13 AM
Greetings @naagaraj , The default setting for new Windows Event Logs is to ingest all logs - including historical logs. When you deploy that, it's not surprising that space quickly fills as Splunk handles the backlog. If you don't want historical logs, take a look at the current_only setting specifically for Windows Event Logs. https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#Windows_Event_Log_Monitor
... View more
03-12-2021
05:26 AM
Greetings @sanjubaba, See below for the two relevant pieces of documentation regarding setting index retention policies: https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setaretirementandarchivingpolicy https://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf
... View more
03-01-2021
09:09 AM
Greetings @Marco, Take a look at this free, popular splunkbase app: https://splunkbase.splunk.com/app/4182. Everything you need should be in the description. Good luck!
... View more
02-20-2021
11:24 AM
Greetings @mooqie, Are you looking for a fully automated solution? If so, you'll need to do more work on your side. If you just want to display what you have in Splunk through telegram, this should be a good start: https://splunkbase.splunk.com/app/4030
... View more
02-18-2021
04:03 AM
1 Karma
I'm not completely following what you're asking, but there are definitely some things to fix. When you use | makeresults, it automatically creates a _time field equal to the current time. That is the "time" field that you are trying to manipulate (which is the same for every row). What you're looking for is something like this: | makeresults | eval _raw = "2021-02-17 09:09:50 Calculated ABC. Action took 100 milliseconds"
| append [ | makeresults | eval _raw = "2021-02-17 10:09:50 Calculated XYZ. Action took 122450 milliseconds" ]
| append [ | makeresults | eval _raw = "2021-02-17 11:09:50 Calculated ABC. Action took 10 milliseconds" ]
| append [ | makeresults | eval _raw = "2021-02-17 12:09:50 Calculated XYZ. Action took 67543 milliseconds" ]
| append [ | makeresults | eval _raw = "2021-02-17 14:09:50 Calculated ABC. Action took 11 milliseconds" ]
| append [ | makeresults | eval _raw = "2021-02-17 15:09:50 Calculated XYZ. Action took 5 milliseconds" ]
| append [ | makeresults | eval _raw = "2021-02-17 16:09:50 Calculated ABC. Action took 600 milliseconds" ]
| rex field=_raw "Calculated (?<ACTION>[^\.]+)\."
| rex field=_raw "Action took (?<DURATION>\d+) milliseconds"
| eval time = substr(_raw, 0, 20)
| eval _time = strptime(time, "%F %H:%M:%S")
| eval time = strftime(_time, "%F %H:%M:%S")
| sort 0 ACTION -DURATION
| streamstats count by ACTION
| where count <= 2
| stats list(DURATION) as "Top 2 Durations", list(time) as Time by ACTION Keep in mind that _time should always be an epoch so you should keep your human-readable time in a non-_time field. That's why I seem to switch back and forth. As a side note, assigning the _time and the two rex statements should all be done at the sourcetype definition level. You should NOT actually be doing any of this in a search in production. https://docs.splunk.com/Documentation/Splunk/latest/Data/Createsourcetypes
... View more
02-17-2021
03:14 PM
I see, I see. How recent does the data need to be? Another option would be to combine the elements from my original post with a | loadjob as your base search instead. If you do it that way, you would run the base search over the past month every hour? Every day? Only during working hours? It depends on your use case. Either way, the base search would not search anything at all. Instead, it would just pull the results from the latest scheduled search immediately, and then you could apply your filters to that data set. If you still need a time picker, you'd have to build a custom one that uses the where command instead.
... View more
02-17-2021
02:32 PM
Greetings @klim, Correct me if I'm misunderstanding, but I doubt your search is so big that you can't do a "one-time" load into memory of the results, and then filter them in-memory instead of creating a new search to send back to the indexers. Below is a run-anywhere dashboard of what I'm talking about. The base search runs on dashboard load, however, changing either of the two drop-downs does NOT initiate any kind of reload. Instead, they filter the results that have already been retrieved by the base search. In my example, changing the time selector DOES require a new search because the time selector changes the base search itself. <form>
<search id="baseSearch">
<query>index=_internal
| table _time index sourcetype source host component _raw</query>
<earliest>$timeSelector.earliest$</earliest>
<latest>$timeSelector.latest$</latest>
</search>
<description>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-accelerate-a-search-that-uses-values-from-a-dropdown/m-p/540310#M37024</description>
<fieldset submitButton="false">
<input type="time" token="timeSelector" searchWhenChanged="true">
<label>Time Selector</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="sourcetype" searchWhenChanged="true">
<label>sourcetype</label>
<choice value="*">All</choice>
<default>*</default>
<prefix>sourcetype="</prefix>
<suffix>"</suffix>
<initialValue>*</initialValue>
<fieldForLabel>sourcetype</fieldForLabel>
<fieldForValue>sourcetype</fieldForValue>
<search base="baseSearch">
<query>dedup sourcetype | fields sourcetype | sort sourcetype</query>
</search>
</input>
<input type="dropdown" token="component" searchWhenChanged="true">
<label>component</label>
<choice value="*">All</choice>
<default>*</default>
<prefix>component="</prefix>
<suffix>"</suffix>
<initialValue>*</initialValue>
<fieldForLabel>component</fieldForLabel>
<fieldForValue>component</fieldForValue>
<search base="baseSearch">
<query>dedup component | fields component | sort component</query>
</search>
</input>
</fieldset>
<row>
<panel>
<table>
<search base="baseSearch">
<query>search $sourcetype$ $component$</query>
</search>
<option name="drilldown">cell</option>
</table>
</panel>
</row>
</form> If that doesn't help, let me know what I misunderstood, and I'll be happy to update my answer.
... View more
02-17-2021
11:31 AM
1 Karma
Greetings @v33jay, Try this run-anywhere search using your sample data. I had to change the rex because yours were too aggressive. | makeresults | eval _raw = "Calculated ABC. Action took 100 milliseconds"
| append [ | makeresults | eval _raw = "Calculated XYZ. Action took 122450 milliseconds" ]
| append [ | makeresults | eval _raw = "Calculated ABC. Action took 10 milliseconds" ]
| append [ | makeresults | eval _raw = "Calculated XYZ. Action took 67543 milliseconds" ]
| append [ | makeresults | eval _raw = "Calculated ABC. Action took 11 milliseconds" ]
| append [ | makeresults | eval _raw = "Calculated XYZ. Action took 5 milliseconds" ]
| append [ | makeresults | eval _raw = "Calculated ABC. Action took 600 milliseconds" ]
| rex field=_raw "Calculated (?<ACTION>[^\.]+)\."
| rex field=_raw "Action took (?<DURATION>\d+) milliseconds"
| sort 0 ACTION -DURATION
| streamstats count by ACTION
| where count <= 2
| stats list(DURATION) as "Top 2 Durations" by ACTION
... View more
02-17-2021
07:23 AM
Greetings @Glasses, Try this: | inputlookup a-list.csv
| eval FLAG = "a-list"
| append [ | inputlookup b-list.csv
| eval FLAG = "b-list" ]
| append [ | inputlookup c-list.csv
| eval FLAG = "c-list" ]
... View more
02-15-2021
08:45 AM
1 Karma
I misunderstood your question. Try this: sourcetype=requests
| eventstats values(device_id) as device_id by request_id
| search device_id="XYZ" Side note: you should start every search with "index=ABC" for much more optimized searching.
... View more
02-15-2021
06:05 AM
Greetings @moguai , Take a look at this search. It should get you close to what you're after. Note that the eventstats and the stats will work by themselves without the other. I included both so you will have more options with manipulating your dataset. | makeresults | eval _raw = "req.begin \"Started... deviceId=\"12345\", request_id=\"1\""
| append [ | makeresults | eval _raw = ".... \"request_id=\"1\" deviceId=???" ]
| append [ | makeresults | eval _raw = ".... \"request_id=\"1\" deviceId=???" ]
| append [ | makeresults | eval _raw = ".... \"request_id=\"1\" deviceId=???" ]
| append [ | makeresults | eval _raw = "req.end ... \"request_id=\"1\" deviceId=???" ]
| reverse
| rex "deviceId=\"?(?<deviceId>\d+)\"?"
| rex "request_id=\"?(?<request_id>\d+)\"?"
| eventstats values(deviceId) as deviceId by request_id
| stats list(_raw) as events by request_id
... View more
02-11-2021
06:56 AM
1 Karma
Greetings @mah, Give the search below a try: index=_audit sourcetype=audittrail "outputlookup" "my_lookup.csv"
| table _time action user info search
... View more
02-09-2021
11:12 PM
1 Karma
Greetings @matthewe25 , I know this isn't exactly what you want, but this might help you: https://community.splunk.com/t5/Alerting/Configure-an-alert-based-on-the-number-of-results-as-warning/m-p/368892 As far as your actual question, I would test whether you can modify the savedsearches.conf file directly to try to set the severity to the same thing (e.g. $result.Criticality$) but try using numbers instead of words. It's a long shot, and it's definitely not documented, but that's the only way I can think of this working. As you said in your post, this situation is normally handled by using separate alerts. One way to make them slightly more dynamic is to retrieve the thresholds from a lookup. If you do that, at least you won't have to touch the multiple alerts to modify the thresholds moving forward.
... View more
02-09-2021
11:02 PM
Greetings @pedram , See here: https://community.splunk.com/t5/Splunk-Search/How-to-display-a-popup-when-i-open-the-dashboard/m-p/538717#M152317 Long story short. Yes, it's possible. No, Splunk can not do it natively. If you want it, you have to build it. However, for your use case, Splunk can natively publish custom messages to the Messages drop-down at the top-right of every screen. Here's the REST endpoint to manipulate it: https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsystem#messages. It is accessible via GUI as Settings > User Interface > Bulletin Messages.
... View more
02-09-2021
06:11 AM
Greetings Mrig342, Here's a run-anywhere search that should get you what you want. You'll just have to update it to fit your data. It's important that you end the search with a stats command. | makeresults | eval File_System = "\logs", Disk_Usage = "41"
| append [ | makeresults | eval File_System = "\opt" , Disk_Usage = "73" ]
| append [ | makeresults | eval File_System = "\var" , Disk_Usage = "69" ]
| append [ | makeresults | eval File_System = "\apps", Disk_Usage = "48" ]
| stats max(Disk_Usage) by File_System
... View more
02-09-2021
01:52 AM
Silly question, but did you restart Splunk after making the changes?
... View more
02-09-2021
01:03 AM
If your outputs.conf was set up properly and nothing was blocking it, the default _internal configuration still should have been sending. Regardless, glad you got it figured out! Please mark your answer as the accepted answer since that resolved the initial question in case anyone else comes across this.
... View more
02-05-2021
04:54 AM
That all looks good. I don't think it's an issue, but you only need [tcpout] & [tcpout:groupname] OR [tcpout-server://...]. Can you try it with just the last line in your file? Also, can you manually check the forwarder's logs with that configuration? The crucial log file will be: C:\Program Files\SplunkForwarder\var\log\splunk\splunkd.log In particular, search for [ERROR] and [WARN], and TCPOutputProc.
... View more
02-05-2021
02:18 AM
Greetings @JakeK, It sounds like you're most of the way there! You clearly have gone through these steps in some way in order to get the deployment clients talking to the deployment server (your Splunk Enterprise instance). That is nice to have, but all the deployment server really does is hands out configurations to the clients and as you can see handles phoning home. This is data that goes mostly to the clients from 8089 (and minimal data comes back from the clients over the same port). You now need to configure where you want the forwarders' data to go. This will be a one-way trip from the forwarders to Splunk Enterprise over 9997. Here is the general documentation covering this, but I'll provide a quick-and-dirty example that should work with your case. On a test forwarder, create the file $SPLUNK_HOME/etc/system/local/outputs.conf. In it, define the following: [tcpout-server://10.11.12.321:9997] Here is the full documentation for outputs.conf: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf. You should be able to use any resolvable form (ip address, host name, or FQDN) of your Enterprise instance. I'm not familiar enough with Azure, but I recommend using an internal IP/name just in case Azure charges egress for sending the data "externally." Once complete, restart splunk with $SPLUNK_HOME/bin/splunk restart. The data should come in quickly after the forwarder is restarted. P.S. Your warning is unrelated. I'm pretty sure all new Splunk installs show that when searching the internal index.
... View more
02-05-2021
01:53 AM
Greetings @nadeige1 , I have a few points to make. First, try not to use transaction when not necessary. Splunk explicitly says this; the reason is that it is not as efficient as other commands that can often do the same thing, see here. Second, I need to make two assumptions. The line 2021-01-25 12:59:18,355 - [INFO] ADU identified SNR: 917175 is a copy/paste from the first SNR line, and the timestamp should actually be more like 2021-01-25 12:59:36,777 so that your sample data is in _time sorted order. Error code 0x154: 7 occurrences for SNR 917173 is a miscalculation. It should really be 10. If those assumptions are correct, here is a run-anywhere search that will get you what you're asking: | makeresults
| eval _raw =
"2021-01-25 12:59:18,355 - [INFO] SNR: 917173
2021-01-25 12:59:21,868 - [INFO] 0x100:S_Home
2021-01-25 12:59:22,312 - [INFO] 0x130:S_Cycle
2021-01-25 12:59:22,314 - [INFO] 0x154:S_VACON
2021-01-25 12:59:22,316 - [INFO] 0x152:S_MQLOFF
2021-01-25 12:59:22,629 - [INFO] new file cycle: 17320
2021-01-25 12:59:23,141 - [INFO] 0x154:S_VACON
2021-01-25 12:59:23,142 - [INFO] 0x151:S_MQLON
2021-01-25 12:59:23,741 - [INFO] 0x154:S_VACON
2021-01-25 12:59:23,742 - [INFO] 0x152:S_MQLOFF
2021-01-25 12:59:25,645 - [INFO] 0x152:S_MQLOFF
2021-01-25 12:59:25,646 - [INFO] 0x156:S_VACOFF
2021-01-25 12:59:25,721 - [INFO] 0x100:S_Home
2021-01-25 12:59:27,095 - [INFO] 0x130:S_Cycle
2021-01-25 12:59:27,102 - [INFO] 0x154:S_VACON
2021-01-25 12:59:27,104 - [INFO] 0x152:S_MQLOFF
2021-01-25 12:59:27,425 - [INFO] new file cycle: 17321
2021-01-25 12:59:27,952 - [INFO] 0x154:S_VACON
2021-01-25 12:59:27,953 - [INFO] 0x151:S_MQLON
2021-01-25 12:59:28,856 - [INFO] 0x154:S_VACON
2021-01-25 12:59:28,857 - [INFO] 0x152:S_MQLOFF
2021-01-25 12:59:30,450 - [INFO] 0x152:S_MQLOFF
2021-01-25 12:59:30,451 - [INFO] 0x156:S_VACOFF
2021-01-25 12:59:30,504 - [INFO] 0x100:S_Home
2021-01-25 12:59:31,624 - [INFO] 0x130:S_Cycle
2021-01-25 12:59:31,625 - [INFO] 0x154:S_VACON
2021-01-25 12:59:31,627 - [INFO] 0x152:S_MQLOFF
2021-01-25 12:59:31,951 - [INFO] new file cycle: 17322
2021-01-25 12:59:32,478 - [INFO] 0x154:S_VACON
2021-01-25 12:59:32,479 - [INFO] 0x151:S_MQLON
2021-01-25 12:59:33,432 - [INFO] 0x154:S_VACON
2021-01-25 12:59:33,433 - [INFO] 0x152:S_MQLOFF
2021-01-25 12:59:34,920 - [INFO] 0x152:S_MQLOFF
2021-01-25 12:59:34,922 - [INFO] 0x156:S_VACOFF
2021-01-25 12:59:34,993 - [INFO] 0x100:S_Home
2021-01-25 12:59:36,321 - [INFO] 0x130:S_Cycle
2021-01-25 12:59:36,325 - [INFO] 0x154:S_VACON
2021-01-25 12:59:36,327 - [INFO] 0x152:S_MQLOFF
2021-01-25 12:59:36,777 - [INFO] ADU identified SNR: 917175
2021-01-25 12:59:37,190 - [INFO] 0x154:S_VACON
2021-01-25 12:59:37,190 - [INFO] 0x151:S_MQLON
2021-01-25 12:59:38,157 - [INFO] 0x154:S_VACON
2021-01-25 12:59:38,158 - [INFO] 0x152:S_MQLOFF
2021-01-25 12:59:39,674 - [INFO] 0x152:S_MQLOFF
2021-01-25 12:59:39,676 - [INFO] 0x156:S_VACOFF
2021-01-25 12:59:39,742 - [INFO] 0x100:S_Home
2021-01-25 12:59:40,902 - [INFO] 0x130:S_Cycle
2021-01-25 12:59:40,904 - [INFO] 0x154:S_VACON
2021-01-25 12:59:40,906 - [INFO] 0x152:S_MQLOFF"
| rex max_match=0 "^(?<raw>.+)\n+"
| fields - _time _raw
| mvexpand raw
| rename raw as _raw
| eval _time = strptime(substr(_raw, 0, 23), "%Y-%m-%d %H:%M:%S,%N")
| sort 0 _time
| rex "SNR:\s+(?<snr_id>\d+)"
| rex "(?<error_code>0x\d+)"
| streamstats last(snr_id) as snr_id
| stats count by snr_id error_code
| sort 0 error_code snr_id A few notes: Everything above the double new line is just for the "run-anywhere" part of the search. You will only need the part of the search below the double new line (starting with | sort 0 _time) I had to extract snr_id and error_code. Hopefully, you already have these fields extracted in your data and should use your field names instead. This is what my output looks like: snr_id error_code count
917173 0x100 4
917175 0x100 1
917173 0x130 4
917175 0x130 1
917173 0x151 3
917175 0x151 1
917173 0x152 10
917175 0x152 2
917173 0x154 10
917175 0x154 3
917173 0x156 3
917175 0x156 1
... View more
02-05-2021
01:07 AM
There is no way to natively do this in Splunk. You would need to design it yourself using JavaScript / Bootstrap. Here are some links that may help if you want to go down that path: https://www.splunk.com/en_us/blog/tips-and-tricks/using-bootstrap-modal-with-splunk-simple-xml.html https://docs.splunk.com/DocumentationStatic/WebFramework/1.0/ https://dev.splunk.com/enterprise/docs/developapps/visualizedata/usewebframework/aboutsplunkjsstack/ https://hurricanelabs.com/splunk-tutorials/splunk-custom-modal-view-creation-part-1-revealing-the-path/
... View more
02-04-2021
05:46 AM
1 Karma
You have the ^\. part of the regex correct, but \S is matching a single non-whitespace character as seen here. I assume what you are really going for is ^\.\S*, but it would be more accurate to use ^\..* to blacklist every single file that either is a . or starts with one (see that here). The difference is that using \S* would not blacklist files that start with a . but have a space in them. (Sorry for the bad formatting. Splunk is throwing all kinds of errors when I try to properly format the text)
... View more
07-15-2020
03:29 PM
By "splunk table", I assume you mean the results of a search as it appears in your screenshot. If this is the case, you can compare the current data to a previous time's data. The search below will retrieve the unique data from the previous five minutes but only if it is not present in the previous day outside that five minute window. index=<your_index> sourcetype=<your_sourcetype> earliest=-5m latest=now
| table key Plugin_version Release
| search NOT
[ | search index=<your_index> sourcetype=<your_sourcetype> earliest=-1d latest=-5m
| table key Plugin_version Release ]
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-20-2025
11:41 PM
|
Karma from
Karma given to
